Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    9s
  • max time network
    72s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-en-20220113
  • submitted
    05/02/2022, 07:52

General

  • Target

    f6fc7442449ac48b039f5e29230bd26383b62bee2a050f5e81553755b69e6f25.exe

  • Size

    944KB

  • MD5

    b31b8740568360abdfcf934916c65bca

  • SHA1

    7926eb5dc593c8a82bd5b7aecbbcd1255f4e6685

  • SHA256

    f6fc7442449ac48b039f5e29230bd26383b62bee2a050f5e81553755b69e6f25

  • SHA512

    77ee7ff01783d9eb13587952f2d4e8440a32f6533435fe8cfd36a55bc74b7a7382bfffb49646d4e49ed9a556d961e6ab8e67c5e53f76682c59762456a6aaf6a9

Score
4/10

Malware Config

Signatures

  • Drops file in Windows directory 6 IoCs
  • Modifies data under HKEY_USERS 41 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f6fc7442449ac48b039f5e29230bd26383b62bee2a050f5e81553755b69e6f25.exe
    "C:\Users\Admin\AppData\Local\Temp\f6fc7442449ac48b039f5e29230bd26383b62bee2a050f5e81553755b69e6f25.exe"
    1⤵
      PID:3832
    • C:\Windows\System32\WaaSMedicAgent.exe
      C:\Windows\System32\WaaSMedicAgent.exe 5bfa9f6bfd4ebb6370c74bc8232155b5 HEi96ZH5BEeV6ft6KBdI+g.0.1.0.0.0
      1⤵
      • Modifies data under HKEY_USERS
      PID:4548
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
      1⤵
      • Drops file in Windows directory
      • Suspicious use of AdjustPrivilegeToken
      PID:4368

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/4368-130-0x00000167BCD30000-0x00000167BCD40000-memory.dmp

      Filesize

      64KB

    • memory/4368-131-0x00000167BCD90000-0x00000167BCDA0000-memory.dmp

      Filesize

      64KB

    • memory/4368-132-0x00000167BFA80000-0x00000167BFA84000-memory.dmp

      Filesize

      16KB